AWS Shield

A DDoS attack tries to knock a site offline by burying it in traffic from thousands of hijacked machines at once. AWS Shield is the AWS service that absorbs and filters those floods before they reach your servers. It works at the edges of the AWS network, where there is far more capacity than any single website has.

It comes in two tiers. Shield Standard is free and automatic for every AWS customer: it protects against the most common network-level attacks, like floods of junk packets or half-open connections, without you doing anything. Shield Advanced is a paid subscription for organizations that are likely targets. It adds detection tuned to your own traffic, detailed reports during an attack, access to an AWS response team that can step in around the clock, and protection against the surprise bill when an attack makes your services scale up.

Shield and AWS WAF are usually used together. Shield handles brute-force volume at the network level; WAF handles smarter attacks that look like real web requests, such as one bot hammering the login page. Putting the site behind Amazon CloudFront helps both, since traffic then meets AWS's large edge network first.